Repository navigation
Upload exact CI-built Worker artifacts on credentialed runners - #222
Merged
Merged
Conversation
Contributor
Author
|
/review Review 8879a43 for blockers in the production-artifact/upload boundary: SHA/run/attempt identity, main/fork/public guards, no custom build or app install on the credentialed host, credential omission, and promotion ordering. Read-only review; local gate already runs in the implementing lane, so do not run a concurrent heavy gate there. Existing app cutovers and canonical parser work are explicitly outside this PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Main commits currently need a second production build in Workers Builds to upload a version. Add an opt-in production artifact to the existing CI build and a separate credentialed upload callable that consumes that exact SHA/run/attempt without app checkout, app installation, rebuild, migration or promotion. Existing callers remain unchanged until opting in.
The producer excludes docs/test-only pushes and leaves an explicit successful-step receipt for promoters that share their PR/main CI workflow. A separate main-only caller can use push.paths-ignore. Upload is same-repository main push/dispatch only, private linux-deploy group pinned, public ubuntu-latest, per-repo cancellation, optional per-app secrets with warning/skip when absent. Missing/cross-run artifacts and custom build configurations fail closed. Production artifacts retain one day; E2E continues using R2.
Validation:
Full gate timed output
.github/workflows/ci.yml: PASS 2.0sscripts/lint_callables.py: PASS 1.1sscripts/test_actionlint_native_permissions.py: PASS 1.5sscripts/test_apple_gate.py: PASS 19.8sscripts/test_cache_paths.py: PASS 1.7sscripts/test_ci_admission.py: PASS 11.9sscripts/test_ci_artifact_store.py: PASS 11.4sscripts/test_dependency_audit.py: PASS 29.4sscripts/test_design_ledger.py: PASS 2.0sscripts/test_design_publish.py: PASS 0.6sscripts/test_e2e_build_artifact.py: PASS 6.5sscripts/test_e2e_mode.py: PASS 11.5sscripts/test_e2e_pr_subset.py: PASS 22.8sscripts/test_e2e_quarantine.py: PASS 3.8sscripts/test_e2e_reuse.py: PASS 41.7sscripts/test_e2e_skip_paths.py: PASS 65.6sscripts/test_eslint_cache.py: PASS 3.6sscripts/test_exact_candidate.py: PASS 1.1sscripts/test_extra_env.py: PASS 0.3sscripts/test_fast_path.py: PASS 54.6sscripts/test_flake_digest.py: PASS 1.3sscripts/test_foundation_check.py: PASS 17.5sscripts/test_package_auth_cleanup.py: PASS 15.7sscripts/test_package_batch_metadata.py: PASS 2.5sscripts/test_permission_ceiling.py: PASS 4.4sscripts/test_playwright_toolchain.py: PASS 6.1sscripts/test_preview_gate.py: PASS 15.5sscripts/test_production_upload.py: PASS 3.1sscripts/test_python_static_gate.py: PASS 0.2sscripts/test_quality_gates.py: PASS 5.5sscripts/test_red_main_listener.py: PASS 4.5sscripts/test_required_gate.py: PASS 0.3sscripts/test_reusable_browser_tests.py: PASS 1.8sscripts/test_runner_default.py: PASS 23.5sscripts/test_script_gates.py: PASS 50.4sscripts/test_store_placement.py: PASS 1.6sscripts/test_taskgraph.py: PASS 24.3sscripts/test_tee_pipefail.py: PASS 0.1sworkflow-gate PASSSelf-check: a871d7a — main/fork/public routes, source-run binding, no app execution on deploy, no production pointer/migration changes, no existing permission ceiling widened. Independent review requested at #222 (comment). No reaction/review after five minutes; using the documented VERIFY-RECIPE fallback self-check. No claim of independent reviewer approval.
Rollout remains open: Stonx CI currently disables its production build; required public build inputs and the canonical deployment builder parser need adaptation. The lane has no nvault credential, so it cannot obtain raw Builds minutes or perform scoped provider cutover. No app or Workers Builds integration is changed by this PR.
Refs narduk-enterprises/agent-infrastructure#4795